https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-02T16:40:24.761080+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-84799 CVE-2026-84799 — Craft CMS before 5.11.0 PII Disclosure via GraphQL User Relations 2026-10-02T16:40:25.269416+00:00

Affected: craftcms cms

Craft CMS before 5.11.0 fails to enforce user-group scope filters on native GraphQL user relations including author, authors, uploader, draftCreator, and revisionCreator fields. Attackers with a scoped GraphQL token can query these relations to read usernames, email addresses, and full names of any content author or uploader including administrators.